potentially dangerous Request.Form value

S

shahab

Junior Contributor
Joined
Aug 14, 2003
Messages
206
Location
Iran(Middle East)
I want to update a textbox and also change the HTML elements.



Error:
A potentially dangerous Request.Form value was detected from the client (TextBox1="<br> <h1> a <h1/>").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (TextBox1="<br> <h1> a <h1/>").

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

Please help me.
 
Hi,
Yes, that's true. ASP.NET automatically checks if your URL string contains any dangerous values, such as: "<br> <h1> a <h1/>" (HTML code).

Turn off this aut. detection and check the input by yourself.
 
The error message tells you what you need to do. Open the page in the HTML view and at the top there will be a line that starts

<@Page

and ends with

%>

simply add validateRequest=false before the %> to turn off the automatic checking.

Be aware though that this can allow people to enter potentially malicious code into the textboxes and as such your code behind should really check the values entered before using them.

Out of interest is there a reason why you want people to be able to enter HTML tags into your form?
 
If you would like to let this error occur but handle it more
gracefully (by redirecting the user to an "error" page or something),
add code in Application_Error event of the Global.asax file.
You can check if the error is this error by calling Server.GetLastError().
 
How can I change the text properties like being bold or italic or insert image and ...
This was the real reason to put HTML elements in textbox
 
shahab, if this form/page is in a private secured part of your web site then following PlausiblyDamp's suggestion of setting validateRequest to false would be viable.
 
Dear friends,
Look at the edit button beside this form.
Then click it ,
Hello!!!
I would like perform diffrent edits on the texts which users had typede on it.
1-Then I made a database
2-I read the info in a textbox and put an edit button for users to
click it and then they will be able to edit the text.
in this forum we have:
Explorer user prompt + Enter the text to be formatted
A Method that really is limited!
but the capability that I dream is:
User chooses the text in text box(Highlight it) ,then click a button therefore,
he would have a bold or Italic or smallertext on the final show(Scenario)
thanks
 
That could be done using JavaScript except that a textbox cannot display formatted text, you would need to display the end result in a Label or Div
 
similar Error

I am getting the same type of error in integrated enviornment. But if i run the same application from my local enviornment it is working fine. PLease help
 
Hi all,

Today I faced the same problem and hense decided to revoke the old thread.
Now the problem is

Case 1: I am using ASP.NET 1.0 (as my site is developed on the same.)
Here this error never occurs and so there is no need of having validate request tag in the page directive.

Case 2: The server I am hosting it on has ASP.NET 1.1
There it raises this error and hense I am required to put the tag for validateRequest = False. But putting this tag raises the error in ASP.NET 1.0 env.

Now the problem is I want to make it generic so that it could be run on either versions. AND YES I NEED THOSE SCRIPTS TO BE PASSED FROM CLIENT TO SERVER.

Is there any way I can achieve both??

Thanks in advance.
Ashutosh
 
Bucky said:
If you would like to let this error occur but handle it more
gracefully (by redirecting the user to an "error" page or something),
add code in Application_Error event of the Global.asax file.
You can check if the error is this error by calling Server.GetLastError().
Click to expand...

I like this approach.. the "error" page can be done in the HTML <page %> tag.

How do I do this in the Global.asax?
 
Back
Top